Authenticated Remote Code Execution via custom_check_path setting

Details

The custom_check_path setting could be set by any user with 'Administrator' role. This script is executed for every mail received, with the path to the mail contents as argument, potentially leading to a privilege escalation to root for pmg-api versions < 9.1.0, or the local pmg-smtp-filter user for pmg-api >= 9.1.0.

As uploading scripts is not part of the PMG API, the issue only allows executing pre-existing executables on the system, without controlling their enviroment or arguments, which effectively limits the usefulness of the missed permission check.

To prevent exploiting the issue the custom_check_path setting was changed to be only settable by root@pam.

Fixed in

• pmg-api >= 9.1.1 (PMG 9.x)

• pmg-api >= 8.2.12 (PMG 8.x)

References

This issue was discovered internally.